Skip to content

Commit c9cd6ea

Browse files
Remove all permissions in test with soroban-examples workflow (#1594)
### What Remove all permissions in the test with soroban-examples workflow file. ### Why This explicitly declares that the workflow requires no GitHub token permissions, following security best practices by applying the principle of least privilege. The workflow pulls code from another repo and builds it. That other repo is an internal @stellar repo, but it has a different set of permissions and access and so nothing in that repo should be able to escalate into this repo.
1 parent d3a2b77 commit c9cd6ea

File tree

1 file changed

+5
-0
lines changed

1 file changed

+5
-0
lines changed

.github/workflows/test-with-soroban-examples.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,11 @@ concurrency:
99
group: ${{ github.workflow }}-${{ github.ref_protected == 'true' && github.sha || github.ref }}-{{ github.event_name }}
1010
cancel-in-progress: true
1111

12+
# No permissions. This workflow downloads code from outside this repository and
13+
# compiles it. No permissions ensures that any exploit in an external
14+
# repository does not gain access to anything in this repo.
15+
permissions: {}
16+
1217
jobs:
1318
collect-examples:
1419
runs-on: ubuntu-latest

0 commit comments

Comments
 (0)